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Management Audit of the District’s Controls - Laptop Computers 
Final Report - March 3, 2011 

The Temporary District Auditor has completed his management audit of the District’s 
Controls over laptop computers as requested by the Board at its November 10, 2009 
meeting. The audit included an examination of written policies/procedures and 
practices for the safeguarding of laptop computers acquired with District funds. The 
audit also included interviews with District staff and examination of records used by 
District staff to account for laptops in use by District employees. 

District records show a total of 321 portable laptop computers in use, with a total value 
of $1.059 million (hardware and software). This information is based on a spreadsheet 
generated by the Information Technology Unit from an automated tracking system that 
shows laptops recently active on the District's network. This tracking system shows the 
location of each laptop, name of the assigned user, SCVWD Asset Tag Number, Serial 
Number, Product Model, operating system type, and estimated cost. 

According to Information Technology staff, the District also has in possession 
approximately 75 obsolete or broken (considered as surplus) laptops pending disposal. 
Prior to disposal, surplus laptops are stored at the Winfield Warehouse and in the 
storage room maintained by the Information Technology Unit. When necessary, 
Information Technology staff may use these laptops as a source for parts to maintain 
laptops currently in use. 

It was noted in reviewing the District’s budget that the District reduced the funds 
budgeted for computer replacement (desktops, laptops and other computer equipment) 
in the Equipment Service Fund from $622,676 for Fiscal Year 2008-2009 down to 
$35,000 per year for Fiscal Years 2009-2010 and 2010-2011. Information Technology 
staff maintain a replacement/upgrade schedule for computers based on estimated 
useful life. However, due to funding limitations, replacement of computers is on largely 
on an individual as-needed basis. 

Information Technology staff stated that the number of laptops reported stolen or lost in 
the last 3 years has been minimal, with only 2-3 instances and in each case, a police 
report is filed. 

Consistent with the Board's Executive Limitation Policies on Asset Protection, the 
District maintains a number of policies and procedures to safeguard District computing 
resources and its data network. Pending completion of the District's ongoing efforts to 
consolidate its internal operating policies and procedures under the ISO Compliant 
Quality and Environmental Management System, these policies and procedures are 
contained within 4 different documentation systems; 1) the Administrative Policies and 
Procedures Manual, 2) Administrative Bulletins, 3) Santa Clara Valley Water District 
Policies and Procedures, and 4) Quality and Environmental Management System 
(QEMS): 
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• Ad-7.2.101 (Administrative Policies and Procedures Manual) establishes general 
policies to control the security and use of computer equipment. 

• Ad-7.8 (Administrative Policies and Procedures Manual) contains general 
policies and procedures for the security of computer resources. This provision (as 
well as Ad-7.2.101) requires that portable computers be under personal 
supervision, in a locked space, or secured with a locking device at all times, 
especially when traveling. 

• Pursuant to Ad-7.2.107 (Administrative Policies and Procedures Manual), the 
District maintains technical and operational standards for data networking and 
computing District-wide. 

• Administrative Bulletin 2002-10 (July 2002) and Ad-7.2.107 (Administrative 
Policies and Procedures Manual) sets forth the approval process for computer 
acquisitions. Under existing practice, all laptop purchase requests require 
Information Technology approval to ensure that the hardware requested meets 
District standards. However, Information Technology does not initiate purchase 
requests for all orders for new laptops. 

• OEMS W741D23 prohibits District staff from using a District Purchasing Card (P 
Card) for the acquisition of computer equipment/software. 

• Roles and responsibilities for inventory controls for fixed asset equipment are 
contained in Ad-3.3.108 (Administrative Policies and Procedures Manual), and 4- 
601 (Santa Clara Valley Water District Policies and Procedures) 

• Roles and responsibilities for inventory controls for District owned personal 
property are stated in 4-610 (Santa Clara Valley Water District Policies and 
Procedures). 

In summary, while the audit found that reasonable checks and balances exist to ensure 
that laptop purchases are approved appropriately; controls should be strengthened to 
safeguard newly acquired laptops and to ensure the reliability and completeness of 
laptop inventory records. The following findings were discussed with the Chief 
Administrative Officer, Deputy Administrative Officer - Procurement and Operational 
Services Division, Chief of the Information Management Services Division, and Unit 
Manager of the Procurement, Warehouse Services and Contract Administration Unit on 
November 18, 2010. 

Findings 

1. Inventory Controls - As stated above, the current practice for tracking and 
maintaining laptop inventory is based on an automated log of laptops connected 
to the District's data network. Information Technology staff are confident in the 
reliability of this information as a reasonably accurate representation of laptop 
inventory. However, the examination of policies, procedures and practices 
resulting from this audit disclosed a number of weaknesses in management 
controls as follows: 


2 


ATTACHMENT 2 
PAGE 6 OF 16 



Management Audit of the District’s Controls - Laptop Computers 
Final Report - March 3, 2011 


a. Periodic physical inventories of laptops and periodic reconciliations of 
laptops purchased /acquired or disposed of through the surplus disposal 
process to laptops shown on the inventory list are not conducted to verify 
all laptops acquired are accounted for in the inventory records. 

b. Accountability for incoming purchases of laptops is not established 
immediately upon receipt with issuance and installation of an inventory tag 
and updating of the District's laptop inventory records. Under existing 
practice, all incoming shipments of computer hardware, peripherals and 
accessories are received and stored at the Winfield Warehouse pending 
delivery to the requester. Winfield Warehouse staff, pursuant to 
Administrative Bulleting 2002-10 delivers these items directly to the 
requester. Although the Winfield Warehouse logs in all incoming 
shipments, newly acquired laptops are not immediately entered into 
inventory records and issued an inventory tag. 

c. Inventory tags are not issued or installed until the laptop is received from 
the requester by Information Technology staff for setup and software 
installation. It is the requester's responsibility (per Administrative Bulletin 
2002-10) to call the Information Technology Help Desk within 2 working 
days of receiving the computer hardware to schedule software installation. 
Consequently, a period of several days or longer may transpire before an 
inventory tag is issued and affixed and inventory records are updated for a 
newly acquired laptop. This creates a situation where, a laptop could be 
ordered, received by the Winfield Warehouse, delivered directly to an 
employee and if Information Technology is not contacted, the laptop would 
not be reflected in the inventory records maintained by the Information 
Technology Unit. 

d. Incompatible duties are assigned to Information Technology staff. They 
approve purchase requests, maintain laptop inventory records with 
unlimited access, and also have access to unissued/unassigned laptops 
stored either at the Winfield Warehouse or in the Information Technology 
Unit storage area. This condition, combined la, 1b, and 1c, above, create 
a situation where errors, omissions, and losses could go undetected. 

2. Obsolete/Conflicting Procedures - Existing procedures for Fixed Asset 

Inventory Control (Santa Clara Valley Water District Policy and Procedure 4-601), 
and Personal Property Inventory Control (Santa Clara Valley Water District Policy 
and Procedure 4-610) are outdated. Procedure 4-601 defined the value of fixed 
asset equipment for inventory purposes, at $1,000. This was partially replaced 
by Fixed Asset Inventory Control Ad-3.3.108, which changed the value of fixed 
asset equipment to $5,000. Procedure 4-610 requires inventory control and 
accountability for personal property with a value between $500 and $999.99. 

Procedure 4-610 has not been updated and the General Services Division, which 
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was responsible for implementing 4-610, no longer exists and it appears that this 
procedure is no longer being implemented on a District-wide basis. 

Recommendations 

To strengthen its implementation of the Board’s Executive Limitation on Asset Protection 

(EL-7), District management should: 

1. Evaluate the dollar value level of inventory accountability desired for District 
owned personal property and update its internal policies/procedures for personal 
property accountability as a replacement to Procedure 4-610. 

2. To promote transparency, establish a CEO Interpretation for Board Policy EL-7 to 
codify the value levels it defines for fixed and personal property assets to be 
inventoried and controlled. (Note, as a result of actions being taken by District 
management to update its procedures during the audit and subsequent to the 
issuance of the initial draft audit report, as reported at the March 3, 2011, Board 
Ad Hoc Audit Committee meeting, this recommendation is rescinded). 

3. In updating its personal property and fixed asset control procedures, District 
management should include provisions for periodic physical inventories and 
reconciliations; and, ensure that adequate separation of incompatible duties 
exists in defining individual roles and responsibilities. 

4. Establish a priority to establish systems and procedures necessary to ensure that 
inventory control and accountability is established as soon as practical for newly 
acquired laptops (as well as other personal property and fixed assets with a 
value above an amount specified in the updated procedures per 
Recommendation 1, above). 

5. Give priority to conducting a reconciliation of laptops purchased over the last 
three years to the inventory records maintained by the Information Technology 
Unit. This will identify any laptops that might have been purchased but are 
unaccounted for in the Information Technology Inventory. 
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Santa Clara Valley 

Water Dis!ric(J MEMORANDUM 

FC 14 (01-02-07) 


TO: Peter Sakai, Temporary District Auditor FROM: Sharon Judkins, Chief 

Administrative Officer 

SUBJECT: Response to December 2,2010 audit of the DATE: January 7, 2011 

District's Controls - Laptop Computers 


Recommendation 1 

Evaluate the dollar value level of inventory accountability desired for District owned personal property 
and update its internal policies/procedures for personal property accountability as a replacement to 
Procedure 4-610. 

Response: The District agrees with this recommendation. 

This recommendation will be addressed by the Controlled Asset Management (W741033) ISO 
procedure. W741033 will be finalized by January 31,2011 and will replace Procedure 4-610. 

As defined in W741033, a controlled asset is: 

"Personal property with a single unit value less than $5,000 which, due to its commercial appeal and 
portability, is particularly susceptible to theft.Examples of controlled assets include, but are not limited 
to, computers and related peripherals, desktop copiers, fax machines, cameras, radio communication 
equipment, GPS units, cell phones, motorized equipment and office furniture. There is no minimum 
dollar threshold for controlled assets" 

NOTE 1: Controlled Asset Management (W741033) is attached for your reference. 

NOTE 2: Although the audit recommendation is specific to laptops only, W741D33 will cover all 
personal property valued up to $5,000. 

Recommendation 2 

To promote transparency, establish a CEO Interpretation for Board Policy EL-7 to codify the value 
levels it defines to be inventoried and controlled. 

Response: The District partially agrees with this recommendation. 

The District agrees that value levels for fixed and personal property assets should be codified. 
However, establishment of a CEO Interpretation is not necessary, as these value levels have been 
codified in the following procedures: 

• Controlled Asset Management (W741 D33) 

• Fixed Asset Inventory Control System-Equipment (Procedure 4-601) 
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Recommendation 3 

In updating its personal property and fixed asset control procedures, District management should 
include provisions for periodic physical inventories and reconciliations; and, ensure that adequate 
separation of incompatible duties exists in defining individual roles and responsibilities. 

Response: The District agrees with this recommendation 

This recommendation is addressed in the following procedures: 

• Controlled Asset Management (W741D33) requires periodic physical inventory rec oncil iations of 
personal property assets be conducted at least annually. 

• Fixed Asset Inventory Control System-Equipment (Procedure 4-601) requires periodic physical 
inventory reconciliations of fixed assets be conducted at least annually. 


Recommendation 4 

Establish a priority to establish systems and procedures necessary to ensure that inventory control and 
accountability is established as soon as practical for newly acquired laptops (as well as other personal 
property and fixed assets with a value above an amount specified in the updated procedures per 
Recommendation 1, above). 

Response: The District agrees with this recommendation. 

This recommendation is addressed in the following procedures: 

• Controlled Asset Management (W741033) 

• Fixed Asset Inventory Control System-Equipment (Procedure 4-601) 


Recommendation 5 

Give priority to conducting a reconciliation of laptops purchased over the last three years to the 
inventory records maintained by the Information Technology Unit. This will identify any laptops that 
might have been purchased but are unaccounted for in the Information Technology Inventory. 

Response: The District agrees with this recommendation. 

The District will prioritize the task of confirming the status of the laptop inventory. 

This task will be completed by January 31, 2011. 


Sharon Judkin 

Chief Administrative Officer 
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Downloaded or printed copies are for reference only. Verify this is the current version prior to use. See the District website for released 
version. 


1. PURPOSE AND SCOPE 

The purpose of this work instruction is to establish a standard system for accountability and tracking of 
District personal property identified as controlled assets. Controlled assets are acquired through a 
variety of procurement methods, including purchase orders, blanket purchase orders (standing orders 
and requirements contracts), and purchasing cards. 

Some operating units have been given District-wide responsibility for the purchase of specific types of 
assets, such as technology equipment and furniture. If this is the case, those units initiate the 
purchase of those restricted assets and issue the assets to individuals throughout the District. The 
purchase of other, non-restricted types of controlled assets are initiated by District operating units for 
issuance to employees within those units. This work instruction applies to all District operating units. 

This work instruction does not apply to personal property defined by District accounting policy as a fixed 
asset. 

2. DEFINITIONS 

Controlled Asset - Personal property with a single unit value less than $5,000 which, due to its 
commercial appeal and portability, is particularly susceptible to theft. Examples of controlled assets 
include, but are not limited to, computers and related peripherals, desktop copiers, fax machines, 
cameras, radio communication equipment, GPS units, cell phones, motorized equipment and office 
furniture. There is no minimum dollar threshold for controlled assets. 

Controlled Asset Log - A log maintained within each operating unit which includes a current list of all 
controlled assets in the possession of that unit. 

Personal Property - Property owned by the District that is movable and not affixed to real property. 

2. ROLES AND RESPONSIBILITIES 

Chief Officers - Each Chief Officer is responsible for ensuring compliance with this work instruction 
and for requiring the conduct of periodic physical inventories of controlled assets within his or her area 
of responsibility. 

District Employees - Each District employee to whom a controlled asset has been assigned is 
responsible for safeguarding the asset, for ensuring that the asset is used only in the conduct of District 
business, and for notifying the unit manager whenever one of the following events occurs: 

• The employee obtains possession of a controlled asset, regardless of method of acquisition; 

• A controlled asset is transferred to another unit or individual; 

• A controlled asset is lost or stolen; or 

• The asset is no longer usable or is no longer required. 

Operating Unit Managers - Operating unit managers with District-wide responsibility for acquiring 
specific types of assets, such as computer equipment, furniture, etc., are accountable for managing 
controlled assets during the time they are physically within their unit’s possession. In addition, such 
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managers shall maintain a controlled asset log for each asset acquired for assignment to individuals 
throughout the District as well as to individuals within that unit. 

All other operating unit managers are accountable for all controlled assets in the possession of their 
units from the initial date of asset receipt by the individual to whom it is assigned through the date the 
assignment ends. In addition, operating unit managers are responsible for ensuring that: 

* All subordinates are familiar with and in compliance with this work instruction; 

* All controlled assets assigned to individuals within the operating unit are registered in a 
controlled asset log; 

* Loss or theft of controlled assets is investigated and disciplinary action initiated, as appropriate; 

* Unit employees return all assigned controlled assets to the operating unit upon transfer to 
another unit within the District or upon termination of employment; and 

* Controlled assets that are unusable or no longer needed are declared surplus and transferred to 
Procurement staff for disposal. 

Warehouse Staff - Winfield Warehouse staff are accountable for all controlled assets in their 
possession from the date and time delivery is accepted from the supplier through the date and time the 
asset is delivered to the acquiring operating unit. 

3. MONITORING AND MEASUREMENT 

Periodic physical inventories shall be conducted of all controlled assets in the possession of each 
operating unit. 
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4. PROCEDURE 


Details 

X Ref 

Quality Records 

(1) Maintain an up-to-date controlled asset log. 

(Operating Unit Managers) 

• At a minimum, include the following information about each 
controlled asset in the possession of the unit: description of 
asset; make, asset make, model and serial number; name of 
individual to whom the asset is assigned; date of asset receipt 
within the unit; date and reason asset is no longer assigned to 
the identified individual, such as transfer to another operating 
unit, transfer to Procurement as surplus, etc.). 

• Make the initial entry of a controlled asset in the log as soon 
as possible, but no later than three (3) business days following 
its receipt within the operating unit. 

• Update each controlled asset entry in the log whenever the 
following events occur: 

o The asset is assigned to another individual or operating 
unit. 

o The asset is lost or stolen. 

o The asset is declared surplus and transferred to 
Procurement for disposal. 

o Whenever anything else occurs that will impactthe 

District’s ability to locate the asset. 


Controlled Asset 

Log 

(2) Conduct periodic physical inventories of the controlled 
assets listed on the controlled asset log. 

(Operating Unit Managers) 

• Physically locate each controlled asset identified on the controlled 
asset log as being within the possession of unit employees. 

• Correct the information on the log, as required. 

• Investigate missing assets and take disciplinary action, as 
appropriate. 

• Reassign all unused controlled assets, as appropriate. 

• Declare surplus all assets that are no longer needed and transfer 
to Procurement for disposal. 




5. QUALITY RECORDS 


Quality Record 

Filing Order 

Comments 

Controlled Asset Log 

Per Operating Unit Procedures 
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6. CHANGE HISTORY 


Date 

Revision 

Comments 


A 

Initial release into OEMS, effective 
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